[sydevs-bot]

Summary

• The captcha renders in a frame served by SahajCloud (feat(atlas): serve the Turnstile challenge page, pinned to an allowed parent SahajCloud#1076), so Turnstile always sees cloud.sydevelopers.com, whatever page hosts the widget: one hostname, no per-partner Turnstile step.
• The frame names its parent. The URL carries parent=<location.origin>. SahajCloud renders the challenge only for a domain some client record lists, and the page posts its token to that origin alone, so the token cannot reach a third party's frame. This closes the open-framing gap the review thread raised (fix(turnstile): partner hosts fail the captcha with 110200 (unknown domain) #355 (comment)).
• The widget carries no Turnstile configuration. challenge.html, src/challenge.ts, VITE_TURNSTILE_SITE_KEY and One safe intake for everything visitors submit #259's release guard are gone. SahajCloud holds both halves of the key, and refuses a test key in production.
• The console names both fixes. The probe resolves a boolean, as on main. The guard's one message names SahajCloud's origin under frame-src and the page's host for the client record; the browser logs a CSP refusal itself beside it, which tells the two apart. A CSP-refused frame fails at the 10 s handshake timeout; a refused domain fails at once.
• Kept from the earlier passes: the handshake timeout, the per-page probe memo, the six delegated allow features, and reset addressed to the frame's own origin.

Merge together with sydevs/SahajCloud#1076, which serves the page this frames.

Change outline

Flow

 host page (partner origin, or sahajatlas.com in an iframe embed)
   <sahaj-atlas> → useTurnstileGuard → probeTurnstile
-    <iframe src=sahajatlas.com/challenge.html?probe=1>
+    <iframe src=cloud.sydevelopers.com/api/atlas/challenge?parent=<location.origin>&probe=1>
   RegistrationForm / ReportIssueForm → useTurnstile
-    <iframe src=sahajatlas.com/challenge.html?theme&language>
-      page → postMessage(…, '*')                        # any framer got the token
+    <iframe src=cloud.sydevelopers.com/api/atlas/challenge?parent&theme&language>
+      SahajCloud: parent's host in some client's allowedDomains? (or first-party, or loopback)
+        yes → render; every message → postMessage(…, parent)   # browser delivers to that origin only
+        no  → postMessage({type:'error'}, '*')                 # widget fails at once

Contract (docs/embedding.md, CHANGELOG.md)

-frame-src   https://sahajatlas.com
+frame-src   https://cloud.sydevelopers.com          # already in the host's connect-src
 What you configure in the CMS instead
+| The domains you embed on | your client record — the API refuses reads elsewhere, the captcha renders nowhere else |
 Troubleshooting: "security check was blocked" → the console names frame-src, or the domain to list

Files

-challenge.html, src/challenge.ts               # the page lives in SahajCloud now
-scripts/turnstile-release-guard.{mjs,test.ts}  # no key in this build to guard
 src/hooks/use-turnstile.ts                     # frame, protocol and probe; ⚠ cross-repo sync pointer
 src/hooks/use-turnstile-guard.ts               # one console line naming both fixes
 src/test-support/turnstile-frame.ts            # SahajCloud's wire format, written out
 vite.config.ts, .ladle/vite.config.ts, public/_headers, .env   # back to main, minus the guard
 tests/smoke/embed.smoke.test.ts                # back to main, minus the site-key case

Test results

• Lean gate: ✓ lint, typecheck, test:run (157 files, 1864 tests)
• Build: ✓ pnpm build (+ assert:css, assert:maps), no challenge.html emitted. pnpm size: embed 326.6 / 330 KiB, loader 2.4 / 3.2 KiB.
• Watched fail: dropping parent, the channel check or the origin check, accepting an empty token, and dropping either cause from the console advice each turn an assertion red.
• Not verified in a browser. A live solve needs the endpoint deployed, which happens when #1076 ships. SahajCloud's integration spec has since run on #1076's review container: 9 passed.

Manual verification (after both PRs deploy)

1. https://shrimataji.org/test/kn/meditation-centers-in-uk/: open a class and register with a test address. Expect success, not captcha_failed.
2. https://wemeditate.com/map: solve and submit the report-issue form.
3. A page on a host no client record lists: expect the captcha-blocked screen, and the console naming that host.
4. Turnstile dashboard: the hostname list becomes cloud.sydevelopers.com only. Workers Builds: delete VITE_TURNSTILE_SITE_KEY from the production trigger.

Notes for reviewer

• Ladle and every Workers preview now frame production SahajCloud's real challenge (localhost, *.sahajatlas.com and *.contact-c66.workers.dev are always-allowed parents). That is safe: Ladle carries no API key, so a solved token reaches no write.
• A client with an empty allowedDomains gets the captcha-blocked screen if its embed host is on no other client's list. That is #1072's question 1, answer A: an anonymous token page must not treat "empty" as "anyone".
• The per-edit width ceiling is back at 18, as on main.

Closes #343

---

🤖 Generated with Claude Code

[sydevs-bot]

1 question for the reviewer, one per thread.

_{🤖 Written by the sydevs autonomous loop — see what this is}

---

Generated by Claude Code

[sydevs-bot]

Should /challenge.html stay framable by any origin? Nothing here can tell our widget on a partner's page from a third party's frame, so the token goes out to '*' and reset is accepted unchecked.

A — ship as is, file the follow-up (built, recommended). Minting was never gated: the production key lists localhost, so anyone could already solve freely on their own machine. What is new is a token solved in somebody else's visitor's browser, carrying the address SahajCloud sends siteverify as remoteip.

B — frame-ancestors from an allowlist fetched at runtime off the client records. Closes it properly. Costs a fetch before the challenge can render, and brings back a per-partner list — the thing #343 chose this approach to avoid.

C — bind the token in SahajCloud (action, or siteverify's hostname). verifyTurnstile.ts checks success alone today. Does not stop harvesting; stops a harvested token being re-aimed.

Reply with a letter, or your own answer.

_{🤖 Written by the sydevs autonomous loop — see what this is}

---

Generated by Claude Code

[Ardnived]

Would it make sense to implement this challenge.html in SahajCloud itself and then embed it from there? Then we could have access to the list of valid client URLs in the SahajCloud database. Would that allow us to control this better?

[sydevs-bot]

Yes, and better than my B: that list is already enforced. clients.allowedDomains 403s any API read from an unlisted host, so framing from one is already a broken embed — the allowlist costs no new onboarding.

A — build it here. The page and the site key change repos, and turnstile-frame.ts becomes a cross-repo contract. #343 waits on that.

B — a SahajCloud ticket (recommended). This fix ships now; the page stays openly framable until that lands.

_{🤖 Written by the sydevs autonomous loop — see what this is}

---

Generated by Claude Code

[Ardnived]

Go with B, but we don't want to merge this PR if it will be superseded by that ticket.

[sydevs-bot]

Filed sydevs/SahajCloud#1072, with the empty-allowedDomains case as its open question.

Not superseded in substance: it moves where the page is served, not the fix. Measured here, 238 added lines in 5 files re-home — the page, its Vite input, the _headers row, the Ladle plugin. The other +1404/-409 stand either way.

The real cost is that a host sending a CSP changes frame-src twice. That ticket carries an option avoiding it.

Merging is yours, so this stays open.
_{🤖 Written by the sydevs autonomous loop — see what this is}

---

Generated by Claude Code

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	sahajatlas-design	1451d06	Nov 03 2026, 09:43 PM

[sydevs-bot]

🤖 no session running
CI fix 1

recent dispatches

• 22:33Z address-review · attempt 1 · session · done
• 22:33Z address-review · attempt 1 · session
• 21:11Z address-review · attempt 1 · session · done
• 21:11Z address-review · attempt 1 · session
• 02:27Z address-review · attempt 1 · session · done

_{Written by the sydevs dispatcher. Sessions never edit this comment.}

[sydevs-bot]

Smoke is red for a cause outside this branch. I pushed nothing.

The publish step failed: "You cannot upload a new version of a Worker that does not yet exist", so no preview existed and no smoke spec ran.

Measured, not deduced:

• sahajatlas.contact-c66.workers.dev → Cloudflare error code: 1042, and so does pr-344-sahajatlas…, an alias docs/testing.md records green on 2026-10-30. sahajatlas-design… serves 200 on the same subdomain.
• The identical publish failure hit feat(map): brand-colour the map markers and cluster paints #353 at 20:05Z, a branch sharing nothing with this one. Last green CI: 19:10Z.
• sahajatlas.com still answers 200 with our own _headers, so visitors are fine today.

No commit here fixes it — the app Worker is missing from the account CI reads, and versions upload → deploy would deploy every PR to production. Filed as #356.

This branch's own gate is green on 4833aac: Lint, Typecheck & Build and Dependency Review both passed.

_{🤖 Written by the sydevs autonomous loop — see what this is}

---

Generated by Claude Code

[sydevs-bot]

🧐 Adversarial review

The shape is the one #343 decided, and the diff matches it: one code path, our origin, no per-partner step. Twenty-three files, nothing smuggled — every doc, comment and fixture change is a statement this PR makes false, and the smoke refactor is what reaches the second graph the site key moved into. The ladder found no existing owner for the protocol, so turnstile-frame.ts earns its place. Both gaps are outside the app Worker: the challenge page is missing from the Ladle build, and the new cross-origin frame delegates nothing. The body says no preview exists; the design one does, and it found the first one.

Findings

• should-fix Both form stories break on the design playground: /challenge.html is not in the Ladle build — use-turnstile.ts:66
• should-fix The frame carries no allow, and § Permissions Policy was not revisited — use-turnstile.ts:78
• consider challengeOrigin has one caller and re-derives a known origin — turnstile-frame.ts:76
• consider reset posts to '*' while inbound is origin-pinned — use-turnstile.ts:300

What was checked. Read whole on the branch: the three new modules, challenge.html, both hooks, both forms' turnstile seams, _headers, vite.config.ts, .ladle/*, the smoke diff, and the embedding/CHANGELOG/environment/deployment/testing prose. Contract side: no in-tree reader of the CSP table, and _headers sets no CSP, so our own origin cannot refuse our own frame. App preview is missing (#356), so design.sahajatlas.com and the branch's design alias were fetched directly instead. Ladder walked for challenge.html, challenge.ts, turnstile-frame.ts, test-support/turnstile-frame.ts, createChallengeFrame, HANDSHAKE_TIMEOUT_MS and the probe memo: readiness.ts refuses postMessage by design, and live-preview's transport is Payload's library.

_{🤖 Written by the sydevs autonomous loop — see what this is}

---

Generated by Claude Code

[sydevs-bot]

Four critic threads: three adopted, one rebutted. The question thread on src/challenge.ts still waits on you.

Adopted

• 7e445ae — no /challenge.html in the Ladle build. A plugin serves and emits it. Chromium 153: both stories' frames mount and solve, no console errors.
• c5cf15c — the frame carries no allow. It takes the six features api.js sets on its own widget frame. Not the PST pair, which Turnstile asks for under a name no current engine publishes.
• 634cc0a — reset posts to '*'.

Rebutted

• challengeOrigin's third derivation — two derivations and one required read-back.

Lean gate green: lint, typecheck, 1952 tests. The per-edit width ceiling ratcheted 18 → 19 on a fresh timing pair, 6.5s and 7.8s against 12s.

_{🤖 Written by the sydevs autonomous loop — see what this is}

---

Generated by Claude Code

[Ardnived]

Would it make sense to implement this challenge.html in SahajCloud itself and then embed it from there? Then we could have access to the list of valid client URLs in the SahajCloud database. Would that allow us to control this better?

[sydevs-bot]

Two reviewer threads adopted. The question thread has a fourth option now and still waits on you.

Adopted

• 425e2da — streamline use-turnstile.ts. Comments 145 lines → 107, code 189 → 182.
• edbe4b3 — streamline turnstile-frame.ts. Comments 58 → 50, and the one real recreation is gone: challengeSrc and challengeOrigin share one challengeUrl.

Every ⚠ and #NNN survives compressed, per docs/rules/code-comments.md. No spec was edited, which is the test of "preserving behaviour".

Asked

• Serve the page from SahajCloud? — yes, and better than my own B: clients.allowedDomains is already enforced. A or B is yours; I built neither.

Merged origin/main in cleanly, no overlapping file. Lean gate green: lint, typecheck, 1952 tests. The body's "two derivations" note is corrected.

_{🤖 Written by the sydevs autonomous loop — see what this is}

---

Generated by Claude Code

[sydevs-bot]

One thread answered. No commit here — the answer is a ticket in another repo.

Answered

• Serve the page from SahajCloud? → B. Filed feat(atlas): serve the Turnstile challenge, gated by client domains SahajCloud#1072 (High): a GET /api/atlas/challenge endpoint sending frame-ancestors built from every published client's allowedDomains. Its one open question is what a client with an empty list may frame.

Still yours: whether to merge this before that lands. The thread stays open.

Measured on this branch, 238 added lines in 5 files re-home with the page and its build wiring. The other +1404/-409 — the hook, the protocol, the probe, their specs, docs/embedding.md — stand wherever the page is served.

The cost that is not recoverable: a host that sends a CSP changes frame-src twice, from sahajatlas.com to SahajCloud's origin. sydevs/SahajCloud#1072 notes an option keeping that value stable, to weigh before building.

Base is current, no merge needed. No code change, so no gate run. ## Notes for reviewer records the decision.
_{🤖 Written by the sydevs autonomous loop — see what this is}

---

Generated by Claude Code